PortSwigger Web Security disclosed a bug submitted by xctzn: https://hackerone.com/reports/1677155 [Source]